The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) recently announced that it ordered American Medical Response (AMR) to pay a civil monetary penalty of $115,200 for failing to comply with the patient right of access rule under HIPAA.
HIPAA requires that all covered entities provide timely access to a patient’s health information within 30 days after receiving a request for such information from the patient or his/her personal representative. Under the HIPAA rule, the provider can charge a reasonable, cost-based fee for providing the requested information. In this case, OCR investigated AMR, a provider of emergency medical services, after OCR received a complaint from the patient stating that AMR failed to respond to multiple requests for the patient’s records over a six-month period.
In addition to the monetary fine, AMR was ordered to provide the requested records to the patient and amend its HIPAA policies to improve its internal processes for tracking and responding to patients’ requests for records. This action serves as a reminder to all providers that OCR is committed to enforcing all aspects of the HIPAA Rules, and its investigation and enforcement efforts are not limited to combatting data breaches and security incidents that are more frequently in the news.
